Charlyn Ho Shares Legal Insights on Coinbase Breach

Rikka founder Charlyn Ho was recently featured in Magazine by Cointelegraph to discuss the legal complexities surrounding the Coinbase data breach that affected nearly 70,000 users and exposed estimated losses of up to $400 million.

Ho emphasized that while the scale of the breach is significant, legal recourse for affected users in the United States is limited due to how user agreements are structured. “In the US, we have almost complete freedom of contract,” Ho explained. “Generally, contracts are held to be enforceable unless it’s unconscionable or there’s an extreme imbalance of power — like an adult and a child.” She noted that Coinbase’s user agreement includes a limitation of liability and that the company is not legally obligated to reimburse victims, though it has voluntarily committed to reimbursing people who were scammed.

Ho also highlighted that, unlike the European Union’s GDPR, the U.S. lacks a single federal data breach statute. “We have 50 states that all have their individual breach notification rules,” she said, adding that overlapping requirements from regulators like the SEC add further complexity for public companies.

Addressing concerns about Coinbase’s arbitration clause, which was reportedly revised just before the breach announcement, Ho pointed to long-standing legal precedent: “the Supreme Court has ruled in a number of different cases that the FAA preempts any state laws that may ban or restrict class action waivers or arbitration clauses in user agreements.” She noted that arbitration and class action waivers are now standard practice in most terms of service.

The full article, titled " Coinbase hack shows the law probably won’t protect you: Here’s why ," provides a global perspective on liability in crypto breaches, with Ho offering key commentary on how U.S. law compares to regulations abroad.

As Ho's insights underscore, Rikka remains at the forefront of advising clients navigating the evolving regulatory landscape of digital assets, cybersecurity, and consumer protection.